stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions Security & Risk Analysis

wordpress.org/plugins/stepform

Create a survey or quiz within 5 minutes without any coding! Boost sales with the help of functional forms

100 active installs v1.0.4 PHP + WP 4.0+ Updated Sep 5, 2025

contact-formformform-buildermulti-step-formwp-contact-form

A · Safe

CVEs total0

Unpatched0

Last CVENever

Plugin page Download

Safety Verdict

Is stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions Safe to Use in 2026?

Generally Safe

Score 100/100

stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 8mo ago

Risk Assessment

The StepForm plugin v1.0.4 exhibits a mixed security posture. While it demonstrates good practices by using prepared statements for all SQL queries and having no known vulnerabilities, several concerning findings emerge from the static analysis. The presence of an unprotected AJAX handler represents a significant entry point that could be exploited by unauthenticated users. Furthermore, a substantial portion of output is not properly escaped, increasing the risk of Cross-Site Scripting (XSS) vulnerabilities if user-supplied data is not handled with sufficient sanitization. The absence of capability checks on entry points is another area of concern, potentially allowing unauthorized users to trigger plugin actions. Despite the lack of recorded historical vulnerabilities, the identified weaknesses in authentication and output escaping suggest that the plugin is not as robustly secured as it could be. The limited attack surface and lack of critical static analysis findings are positive, but the unprotected AJAX handler and insufficient output escaping are notable risks that require attention.

Key Concerns

Unprotected AJAX handler
Low percentage of properly escaped output
No capability checks on entry points

Vulnerabilities

None known

stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions Security Vulnerabilities

No known vulnerabilities — this is a good sign.

Version History

stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions Release Timeline

No version history available.

Code Analysis

Analyzed Mar 16, 2026

stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions Code Analysis

Dangerous Functions

Raw SQL Queries

0 prepared

Unescaped Output

18 escaped

Nonce Checks

Capability Checks

File Operations

External Requests

Bundled Libraries

Output Escaping

42% escaped43 total outputs

Attack Surface

1 unprotected

stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions Attack Surface

Entry Points2

Unprotected1

AJAX Handlers 1

authwp_ajax_stepFORM_load_formsincludes\core.php:41

Shortcodes 1

[stepFORM] includes\core.php:38

WordPress Hooks 15

actionwidgets_initincludes\core.php:34

actionadmin_menuincludes\core.php:35

actionadmin_headincludes\core.php:39

actioninitincludes\core.php:40

actionadmin_footerincludes\core.php:42

actionadmin_menuincludes\core.php:43

filtermce_external_pluginsincludes\mce.php:18

filtermce_buttons_2includes\mce.php:19

actionadmin_print_footer_scriptsincludes\mce.php:20

actionadmin_headincludes\mce.php:21

actionadmin_footerincludes\mce.php:22

actionadmin_initincludes\page.php:36

actionadmin_headincludes\page.php:52

actionadmin_headincludes\page.php:132

actionplugins_loadedstepFORM.php:44

Maintenance & Trust

stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions Maintenance & Trust

Maintenance Signals

WordPress version tested6.8.5

Last updatedSep 5, 2025

PHP min version

Downloads5K

Community Trust

Rating92/100

Number of ratings5

Active installs100

Alternatives

stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions Alternatives

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor

metform

The most popular Elementor forms builder to create WordPress forms like contact forms, booking forms, feedback form, survey forms, application forms a …

600K 26 CVEs

NEX-Forms – Ultimate Forms Plugin for WordPress

nex-forms-express-wp-form-builder

Build beautiful responsive forms for WordPress. Contact forms, surveys, quizzes, booking forms, payments, popups & more with NEX-Forms...

7K 31 CVEs

NEX-Forms ADD ON – Form Themes

nex-forms-form-themes-add-on

100

Build beautiful responsive forms for WordPress. Contact forms, surveys, quizzes, booking forms, payments, popups & more with NEX-Forms...

1K No CVEs

NEX-Forms ADD ON – Zapier Integration

nex-forms-zapier-add-on

100

The NEX-Forms Zapier Integration Add-on enables you to seamlessly connect your form submissions to over 10,000 apps.

100 No CVEs

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

wpforms-lite

The best WordPress contact form plugin. Drag & Drop form builder to create beautiful contact forms, payment forms, & other custom forms.

6.0M 16 CVEs

Developer Profile

stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions Developer Profile

stepform

2 plugins · 100 total installs

trust score

Avg Security Score

100/100

Avg Patch Time

30 days

View full developer profile

Detection Fingerprints

How We Detect stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths

/wp-content/plugins/stepform/assets/css/mce.css/wp-content/plugins/stepform/assets/css/popup.css/wp-content/plugins/stepform/assets/css/settings.css/wp-content/plugins/stepform/assets/js/scripts.js/wp-content/plugins/stepform/assets/js/settings.js

Script Paths

/wp-content/plugins/stepform/assets/js/scripts.js/wp-content/plugins/stepform/assets/js/settings.js

Version Parameters

/assets/css/mce.css?ver=1.0.4/assets/css/popup.css?ver=1.0.4/assets/js/scripts.js?ver=1.0.4/assets/css/settings.css?ver=1.0.4/assets/js/settings.js?ver=1.0.4

HTML / DOM Fingerprints

CSS Classes

stepFORM-wrapperstepFORM-headerstepFORM-contentstepFORM-content-wrapstepFORM-content-textstepFORM-content-instruction

Data Attributes

id="stepFORM-content-text"id="stepFORM-content-instruction"id="stepFORM-screen-0"id="stepFORM-screen-1"id="stepFORM-screen-2"id="setoptions"+3 more

JS Globals

QTags.addButton('button_stepFORM'

Shortcode Output

[stepFORM id=

FAQ

Frequently Asked Questions about stepFORM: Plugin for Building Contact Forms, Advanced Multi-Step Forms, Payment Integration, and Custom Contact Form Solutions